Maxwell Aesthetics

Maxwell Aesthetics operates as a private plastic and aesthetic surgery practice that provides surgical and non‑surgical procedures to individuals seeking alteration or restoration of physical appearance. The organization’s headquarters are located in the United States of America, although the specific city or state is not disclosed in the available sources. Its clinical offerings consist of plastic and aesthetic surgical procedures intended to modify or restore physical appearance. Patient encounters typically begin with a consultation, proceed to surgical planning and execution, and conclude with postoperative monitoring and follow‑up visits. Throughout these encounters, the practice collects, stores, and transmits personal health information that includes identifiers, clinical details, and financial data necessary for treatment and billing. To support these functions, Maxwell Aesthetics relies on electronic health record systems, scheduling software, and networked devices that are integrated into its internal information technology infrastructure.

The personal health information managed by the organization encompasses patients’ full names, dates of birth, diagnostic findings, descriptions of surgical procedures performed, insurance policy numbers, and specifics of any medical devices ordered or implanted. Because this information qualifies as protected health information under federal law, Maxwell Aesthetics is obligated to comply with the Health Insurance Portability and Accountability Act (HIPAA) and to implement administrative, technical, and physical safeguards to protect its confidentiality, integrity, and availability. In May 2020, the practice experienced a ransomware attack conducted by the Maze Team that took place while the organization was resuming operations after a COVID‑19 related closure. The attackers gained access to the network, exfiltrated unencrypted files containing the aforementioned patient data, and subsequently published those files on a public leak site. The leaked files were named in a manner that included each patient’s full name together with sensitive medical and insurance information, thereby increasing the risk of identity theft and medical privacy violations. In addition to patient records, operational documents and network configuration details were compromised, which resulted in the temporary unavailability of the organization’s website and online patient portal during the incident.